Apple released iOS 26.7.1 on September 28, 2026, to fix CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution when processing maliciously crafted files. According to Apple's advisory, the flaw affects iPhone 11 and later models, along with supported iPad Pro, iPad Air, iPad and iPad mini devices running iOS 26 or iPadOS 26. Apple credited Meta Product Security with reporting the issue, and the company indicated the vulnerability may have been exploited in extremely sophisticated attacks against specifically targeted individuals using iOS versions released before iOS 27. The company introduced improved bounds checking to address the security issue, confirming possible exploitation of the zero-day vulnerability. As per Apple's latest disclosure, the description of the exploitation as "extremely sophisticated" indicates the vulnerability may have been used in a targeted intrusion operation rather than widespread opportunistic attacks.
Blockchain security firm SlowMist has issued urgent warnings to cryptocurrency users about the patch's relevance, citing recent iOS exploitation activity that has specifically targeted sensitive wallet information. In an X post, SlowMist said the vulnerability is highly relevant to iOS attack activity the firm has previously tracked, with SlowMist Chief Information Security Officer 23pds linking the security update to a zero-day that was used in attacks involving crypto wallets. The warning comes amid ongoing concerns about iOS exploits targeting crypto wallets, including the FomoPeek application that contained iOS kernel exploitation frameworks capable of accessing wallet data. SlowMist has not publicly demonstrated that CVE-2026-86950 was the specific vulnerability used in earlier incidents, but the firm's observations of iOS attack activity targeting sensitive crypto wallet data provide additional context for user concerns.
Security researchers have identified multiple iOS exploit chains that have raised wallet security concerns. According to SlowMist, the Darksword advanced iOS exploit framework may have been adapted to attack crypto wallets on iOS 26.5, though Apple and Google have not independently confirmed this reported capability. The documented Darksword framework combines multiple vulnerabilities to bypass iOS defenses and install additional payloads, potentially collecting messages, browser history, account information, and cryptocurrency wallet records when attackers gain elevated device access. On September 19, SlowMist reported receiving reports of crypto assets being stolen from users who had previously installed FomoPeek versions 1.1–1.2, with a joint investigation by SlowMist and OKX identifying malicious components including an iOS kernel exploitation framework containing eight exploit methods. Some users who installed the affected versions subsequently reported losing crypto assets, though SlowMist has not established that the FomoPeek incident and CVE-2026-86950 are part of the same attack campaign.
For users previously exposed to malicious wallet software, Binance has recommended creating fresh credentials on uncompromised devices and moving funds when wallet secrets may have been obtained. SlowMist has urged users to update their iPhones, iPads, Macs, and other Apple devices to the latest available security versions, while advising users to avoid installing applications from unknown or untrusted sources and warning against opening suspicious links through Safari or in-app browsers. The firm further recommended treating unexpected files, links, and app-installation prompts with caution. Apple's latest security records show iOS 26.7.1 and iPadOS 26.7.1 were released specifically with the CoreGraphics correction on September 28, while the company's iOS 27.0.1 release appeared on the same date. Enterprise security teams should prioritize deployment through mobile device management platforms, especially for executives, administrators, journalists, and other high-risk personnel, while organizations should verify patch compliance and monitor for unusual application crashes or suspicious file delivery activity.
Apple's disclosure establishes that CVE-2026-86950 can lead to arbitrary code execution, with the company receiving reports of possible exploitation against targeted individuals before iOS 27. However, as reported by Apple, the advisory does not mention cryptocurrency, digital wallets, seed phrases, or private keys, and the company has not disclosed any victim identity or monetary loss connected to the flaw. SlowMist's warning adds crypto-specific context based on recent device-level attacks, though the firm has not established that CVE-2026-86950 itself was responsible for any known cryptocurrency losses. The distinction is important because Apple has not confirmed that CVE-2026-86950 was specifically used to steal cryptocurrency or wallet credentials, while the crypto-wallet connection comes from SlowMist's observations of broader iOS attack activity. The incident carries particular significance for crypto users because smartphones are widely used to access wallets, exchanges, and authentication applications, with potential exposure of sensitive information if attackers gain deep device access. Until all eligible devices are updated, users should treat unexpected attachments and files received through email, messaging applications, or collaboration platforms with caution.
